In order to succeed on advanced attacks like Deepfool [1]} and Carlini & Wagner attack [2]} we need the response of the network to an adversarial attack to detect it. For our second method, the Fourier spectrum of feature maps is used. Both spectra, the magnitude Fourier spectrum (MFS) and the phase Fourier spectrum (PFS) are considered. Employing the feature maps of every other activation layer method the PFS performs very well on all five attack methods.
